feat: surface per-stage duration in report (closes #200)

[SpiliosDimakopoulos]

What this changes

The grounding invariant

The LLM never publishes anything a fresh container didn't independently
execute. Grounding is enforced in code, not prompts.

• This change does not let an unverified command reach tutorial.md,
  step_by_step.md, commands.sh, or the demo tape — or it adds a
  code-level check (not just a prompt rule) that keeps that true.
• Sandbox hardening flags in sandbox.py are unchanged (or the change is
  explicitly discussed in the PR body).

Tests

• python -m pytest tests/ -q passes locally.
• Bug fixes carry a regression test named for the failure/run that found it.
• parse_transcript / normalize.py changes stayed pure and
  deterministic (no LLM calls; testable against fixtures).

Prompt changes (if any)

• N/A — this PR doesn't touch prompts/*.md.
• Included a before/after transcript or run report as evidence.

Housekeeping

• One concern per PR.
• Type hints + docstrings on new/changed public functions.
• If stages or boundaries moved, architecture/README.md and CLAUDE.md
  are updated to match.

[alphacrack]

Thanks @SpiliosDimakopoulos — and sorry, this one arrived second: #204 (@kushin25, opened 2026-07-22) implements the same issue (#200), touching the same six files. That PR is already through a review round and is close to merging, so I'm going to close this one as a duplicate rather than have two people carry the same change.

That's a coordination failure on our side, not a problem with your work — #200 had no "claimed" marker, so there was no way for you to know. We're adding a convention for that (comment on an issue to claim it, and it gets marked) precisely so this stops happening.

Two things if you'd like to keep going, both genuinely open and unclaimed as of right now:

• #42 — a failed ffmpeg GIF conversion is silently swallowed (render.py never checks the returncode), so a broken preview looks like success. Small, self-contained, good first issue.
• #45 — verify_retries is documented as a retry count but collapses to 2 attempts regardless (verify.py:52: total_attempts = 2 if cfg.verify_retries >= 1 else 1), so verify_retries = 3 silently means 2.

Both are pure Python, no Docker, no API key. Comment on whichever you want and I'll mark it claimed so this can't repeat. Also worth noting for next time: the PR template's grounding checklist was left unfilled here — that's the fastest signal a reviewer uses, so filling it in helps your PR move quicker.

[alphacrack]

Closing as a duplicate of #204 — see review comment. Thanks for the work, and sorry for the collision.